PS5 Relapse 漏洞

PS5 Relapse 漏洞
PS5 Relapse Exploit

原始链接: https://github.com/ntfargo/Relapse-Exploit

本项目提供了针对 PS5 固件版本 7.00 至 13.60 的内核漏洞利用程序。使用时，用户需将主 DNS 设置为 45.56.67.85，并访问提供的 Web 漏洞利用链接。该过程利用了涉及 JSC 信息泄露的 WebKit 漏洞，以及通过 `aio_multi_wait` Use-After-Free (UAF) 竞争条件实现内核阶段的读写访问。成功后，ELF 加载器将在 9021 端口监听以接收 Payload。用户需注意，若系统出现挂起或内核恐慌，可能需要多次尝试或重启主机。感谢各贡献者在漏洞利用链方面的工作。 **免责声明：** 本软件仅用于教育和安全研究目的。软件按“原样”提供，不提供任何保证。用户需自行承担风险，并对可能出现的系统不稳定、数据丢失或账号封禁负责。维护者不支持盗版或未经授权的访问，用户必须遵守所有适用的法律法规。

The Hacker News thread centers on the newly released PS5 “Relapse” exploit and broader frustrations with Sony’s closed ecosystem. Many users object that save backups require PS Plus—highlighted by a user whose daughter lost a year of Minecraft progress—rather than USB or other physical storage. This strengthens interest in PCs, SteamOS, and the Steam Machine as more controllable alternatives with physical games and user-managed saves. Participants debate whether cloud gaming is viable, separating technical latency concerns from complaints about subscriptions, vendor control, game preservation, and broadband access. Sony could potentially force cloud adoption even if many users dislike it. Technically, commenters distinguish this kernel exploit from the separate hypervisor exploit needed to run Linux, and note that firmware 14.0 reportedly patched it. Some speculate it may still assist game dumping or backups on vulnerable systems, though that is unconfirmed. Others discuss responsible disclosure, anti-cheat, security, piracy, emulation, and whether Sony’s lockdown serves legitimate purposes or primarily protects its games business.

Supported firmware: 7.00 through 13.60.

In the network settings, set Primary DNS to 45.56.67.85 (Recommended)
Run python serve.py locally, or open https://ntfargo.github.io/Relapse-Exploit/ on the PS5.
The default payloads are stored in payloads/ after a successful run, the ELF loader listens on port 9021.

Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens.

Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an aio_multi_wait uaf race to establish kernel r/w.

ntfargo, ufm42, Sonic_Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.

This project is intended for educational and security research purposes only. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own or are authorized to test, and comply with applicable laws and regulations.

The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage.

PS5 Relapse 漏洞 PS5 Relapse Exploit

PS5 Relapse 漏洞
PS5 Relapse Exploit